---
title: Configure authentication methods
---

import FlattenedSteps from "../../components/FlattenedSteps.astro";
import NavigationSteps from "../../components/NavigationSteps.astro";
import ZulipNote from "../../components/ZulipNote.astro";
import ZulipTip from "../../components/ZulipTip.astro";
import OwnerOnly from "../include/_OwnerOnly.mdx";
import SaveChanges from "../include/_SaveChanges.mdx";

<OwnerOnly />

You can choose which authentication methods to enable for users to log in to
your organization. The following options are available on all
[plans](https://zulip.com/plans/):

* Email and password
* Social authentication: Google, GitHub, GitLab, Apple

The following options are available for organizations on Zulip Cloud Standard,
Zulip Cloud Plus, and all self-hosted Zulip servers:

* Oauth2 with Microsoft Entra ID (AzureAD)

The following options are available for organizations on Zulip Cloud Plus, and all self-hosted Zulip servers:

* [SAML authentication](/help/saml-authentication), including Okta, OneLogin, Entra ID (AzureAD), Keycloak, Auth0
* [SCIM provisioning](/help/scim)

The following authentication and identity management options are available for
all self-hosted servers. If you are interested in one of these options for a
Zulip Cloud organization, contact [support@zulip.com](mailto:support@zulip.com)
to inquire.

* [AD/LDAP user
  sync](https://zulip.readthedocs.io/en/stable/production/authentication-methods.html#ldap-including-active-directory)
* [AD/LDAP group
  sync](https://zulip.readthedocs.io/en/stable/production/authentication-methods.html#ldap-including-active-directory)
* [OpenID
  Connect](https://zulip.readthedocs.io/en/stable/production/authentication-methods.html#openid-connect)
* [Custom authentication
  options](https://python-social-auth.readthedocs.io/en/latest/backends/index.html#social-backends)
  with python-social-auth

### Configure authentication methods

<ZulipNote>
  For self-hosted organizations, some authentication options require
  that you first [configure your
  server](https://zulip.readthedocs.io/en/stable/production/authentication-methods.html)
  to support the option.
</ZulipNote>

<ZulipTip>
  Before disabling an authentication method, test that you can
  successfully log in with one of the remaining authentication methods.
  The [`change_auth_backends` management
  command](https://zulip.readthedocs.io/en/stable/production/management-commands.html)
  can help if you accidentally lock out all administrators.
</ZulipTip>

<FlattenedSteps>
  <NavigationSteps target="settings/auth-methods" />

  1. To use SAML authentication or SCIM provisioning, Zulip Cloud organizations
     must upgrade to [Zulip Cloud Plus](https://zulip.com/plans/), and contact
     [support@zulip.com](mailto:support@zulip.com) to enable these methods.
  1. Toggle the checkboxes next to the available login options.

  <SaveChanges />
</FlattenedSteps>

## Related articles

* [Configuring authentication methods](https://zulip.readthedocs.io/en/stable/production/authentication-methods.html)
  for server administrators (self-hosted only)
* [SAML authentication](/help/saml-authentication)
* [SCIM provisioning](/help/scim)
